CVE-2022-1442

Metform Elementor Contact Form Builder <= 2.1.3 - Sensitive Information Disclosure

7.5 HighPublic exploit

The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php file which can be exploited by an unauthenticated attacker to view all API keys and secrets of integrated third-party APIs like that of PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA and many more, in versions up to and including 2.1.3.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

8.77%Up 7.9 points since May 11, 2022

What each source reports

CVE List Score used 7.5

Metform Elementor Contact Form Builder <= 2.1.3 - Sensitive Information Disclosure

Record: CVE-2022-1442
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-862, CWE-862
Updated: 2026-11-02

EUVDEUVD-2022-24749 7.5

Record: EUVD-2022-24749
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-mxm7-jfgp-4j4v 7.5

The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper...

Record: GHSA-mxm7-jfgp-4j4v
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-862
Updated: 2026-11-02

NVD 7.5

Record: CVE-2022-1442
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-862
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Nuclei	WordPress Metform <=2.1.3 - Information Disclosure
PoC in GitHub	RandomRobbieBF/CVE-2022-1442	2023-08-03

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-1442 is a high vulnerability (CVSS 7.5) in Wpmet Metform Elementor Contact Form Builder, published May 10, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 8.77%, the 95th percentile. No source names a fixed version.